Medium severity · published Feb 13, 2023
CVE-2023-25160
Nextcloud Mail is an email app for the Nextcloud home server platform
5.3
CVSS
0.5%
EPSS
No
On KEV
Description
Nextcloud Mail is an email app for the Nextcloud home server platform. Prior to versions 2.2.1, 1.14.5, 1.12.9, and 1.11.8, an attacker can access the mail box by ID getting the subjects and the first characters of the emails. Users should upgrade to Mail 2.2.1 for Nextcloud 25, Mail 1.14.5 for Nextcloud 22-24, Mail 1.12.9 for Nextcloud 21, or Mail 1.11.8 for Nextcloud 20 to receive a patch. No known workarounds are available.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
Mail · Nextcloud
before 1.11.8; 1.12.0 before 1.12.9; 1.13.0 before 1.14.5; 2.0.0 before 2.2.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-25160
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-25160
Patch
https://github.com/nextcloud/mail/pull/7740
Vendor Advisory
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-m45f-r5gh-h6cx
Permissions Required
https://hackerone.com/reports/1784681
More from Mail
9.8
CVE-2023-48307
Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform
9.8
CVE-2022-31132
Unauthenticated SSRF in 3rd party module "cerdic/csstidy"
8.1
CVE-2024-52508
Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform
7.0
CVE-2020-8156
A missing verification of the TLS host in Nextcloud Mail 1.1.3 allowed a man in the middle attack
6.5
CVE-2023-23944
Nextcloud mail is an email app for the nextcloud home server platform